CLAIMS 

What is claimed is: 

1 . A method of reconstructing a session, the method comprising: 
receiving a plurality of packets over a network interface; 
analyzing the plurality of packets to identify at least a first flow; 
identifying an application for the at least a first flow; 

selecting a corresponding application flow identifier for the application; 
using the corresponding application flow identifier to identify a plurality of flows in 
the plurality of packets corresponding to the session. 

2. The method of claim 1 further comprising generating a quality of service report for the 
session based on the application. 

3. The method of claim 1 wherein the session is associated with an end user experience 
occurring within a definite time bound. 

4. The method of claim 3 wherein the session is comprised of one or more additional 
sessions. 

5. The method of claim 1 further comprising filtering the plurality of packets received 
over the network interface prior to the analyzing, the filtering comprising removing one or 
more packets from the plurality of packets according to one or more packet capture language 
rules. 
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1 6. The method of claim 1 further comprising outputting a plurality of service detail 

2 records at predetermined intervals for the application, each service detail record including a 

3 billing identifier and a usage information, the usage information derived from the number of 

4 packets in the session during the corresponding predetermined interval 

1 7. The method of claim 1 further comprising sending a command to a network device to 

2 control the session based on a policy, the policy defining a quality of service for the 

3 application. 

1^ 1 8. The method of claim 1 further comprising sending a command to a network device to 

ifl 2 control the session based on a policy, the policy defining the amount of resources available to 

111 

|f1 3 the session. 

Mi 

H i 9 t The method of claim 1 further comprising sending a command to a network device to 

ll 2 stop the session based on a policy, the policy specifying a cost for use of resources and the 

f ^ 3 policy triggering the transmission of the command upon the cost exceeding a predetermined 

if 4 amount. 

1 10. A system for reconstructing a session, the system comprising: 

2 a packet source, the packet source generating a plurality of packets; 

3 a flow manager coupled to the packet source, the flow manager identifying at least one 

4 flow in the plurality of packets; 

5 an application recognizer coupled to the flow manager, the application recognizer 

6 identifying an application corresponding to the at least one flow; 
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7 a session streamer coupled to the flow manager, the session streamer identifying a 

8 plurality of flows in the plurality of packets corresponding to the session based on 

9 the application. 

1 11. The system of claim 1 0, wherein each of the plurality of packets includes a plurality of 

2 header elements and the at least one flow includes one or more packets with a common packet 

3 header element: 

1 12. The system of claim 10, wherein the application recognizer can identify at least one of 

2 a file transfer protocol (FTP), a hypertext transfer protocol (HTTP), a simple mail transport 
Hi 3 protocol (SMTP), a domain name service (DNS), a telnet protocol, a post office protocol 
fi 4 (POP), an Internet message access protocol (MAP), a network time protocol (NTP), a 

H 5 Netbios protocol, a network news transport protocol (NNTP), a network time protocol (NTP), 

T 6 a simple network management protocol (SNMP), an Internet Relay Chat (IRC) protocol, a 

S 7 H.323 protocol, a voice over IP protocol, a NetMeeting(TM) protocol, a Quicktime(TM) 

|| 8 protocol, a server message block (SMB) protocol, a RealAudio(TM) protocol, a real time 

P 9 streaming protocol (RTSP), and a real-time transport protocol (RTP). 

1 13. The system of claim 10, wherein the application recognizer signals to the session 

2 streamer to treat the at least one flow as a session when the application recognizer cannot 

3 identify an application for the at least one flow: 

1 14. The system of claim 10, further comprising a data collector coupled to the session 

2 streamer, the data collector for producing service detail records at predetermined intervals for 
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3 the application corresponding to the session, each service detail record including a billing 

4 identifier and a usage information. 



115. An apparatus for reconstructing a session, the apparatus comprising: 

2 means for receiving a plurality of packets; 

3 means for identifying at least a first flow in the plurality of packets; 

4 means for identifying an application for the at least a first flow; 

5 means for selecting a corresponding application flow identifier for the application; 

6 means for identifying a plurality of flows in the plurality of packets corresponding to 
13 7 the session using the corresponding application flow identifier. 

W 1 16. The apparatus of claim 1 5, further comprising means for reporting application 

^ 2 appropriate performance characteristics for the session. 

L 1 17, The apparatus of claim 1 5 5 further comprising means for controlling a network device 

■jLX 

lit 2 according to a policy, the policy defining the amount of resources available to the session. 

iu 1 18, The apparatus of claim 15, further comprising means for charging at least one account 

2 for resources used during the session. 

1 19. A computer data signal embodied in a carrier wave comprising: 

2 a computer program for session reconstruction: 

3 a first set of instructions for identifying at least one flow in a plurality of packets; 

4 a second set of instructions for analyzing the at least one flow to identify an 

5 application corresponding to the flow; and 
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a third set of instructions for identifying a plurality of flows in the plurality of 
packets corresponding to the session based on the application. 
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